Avast WEBforum
Other => Non-Avast security products => Topic started by: Asyn on February 01, 2017, 12:04:52 PM
-
Hi guys,
I wonder if anyone knows about the future of MCS..!?
Last program version is from 2014, last database from 2016. :-\
Cheers,
Asyn
-
Found s.th. in the internet, that i's said "you don't need it under Windows 10/8/7/XP"!
So we don't worry about nothing.
;D
=Snake=
-
Hi guys,
I wonder if anyone knows about the future of MCS..!?
Last program version is from 2014, last database from 2016. :-\
Cheers,
Asyn
Considering the digital signature for the setup file and the database updater have been allowed to expire there is no way to verify the integrity of either of these files. From a security standpoint this is not good.
-
Hi guys,
I wonder if anyone knows about the future of MCS..!?
Last program version is from 2014, last database from 2016. :-\
Cheers,
Asyn
I just wonder if magna86 (Anti Malware Fighter), might know. I seem to recall something about him and the late Argus having some connection there.
-
Hi guys,
I wonder if anyone knows about the future of MCS..!?
Last program version is from 2014, last database from 2016. :-\
Cheers,
Asyn
I just wonder if magna86 (Anti Malware Fighter), might know. I seem to recall something about him and the late Argus having some connection there.
They do, and dr_bora the developer has been busy with other things
-
Hi guys,
I wonder if anyone knows about the future of MCS..!?
Last program version is from 2014, last database from 2016. :-\
Cheers,
Asyn
MCShield dont need signatures to do its work (contain very few signatures) as it work mostly on how the malware infect/spread, but if this changes then i guess we need a program update
-
Hi guys,
I wonder if anyone knows about the future of MCS..!?
Last program version is from 2014, last database from 2016. :-\
Cheers,
Asyn
I just wonder if magna86 (Anti Malware Fighter), might know. I seem to recall something about him and the late Argus having some connection there.
They do, and dr_bora the developer has been busy with other things
Thanks for that, I will tuck that away in my memory again.
-
Hello everyone.
Both main developers and MCS's owner, dr_Bora and bobby has been officially offline dedicated to there personal life.
Thus, MCShield hasn't been major upgraded in a while, and none of them didn't announced EOL (https://en.wikipedia.org/wiki/End-of-life_(product)).
As Pondus mentioned above and should be noted; MCShield never worked as other programs. In most cases, MCShield has been received database updated just to cover possible FP's. Then and now, MCShield still works on some other level. MCS owns heur. engines and routines (I wrote about MCS's power here on BC forum (https://www.bleepingcomputer.com/forums/t/523938/mcshield-malware-remover-not-mcafee-is-it-safe/?p=3299985)) to cover all known malware vector (https://en.wikipedia.org/wiki/Vector_(malware)) usb related attacks.
In other words, MCS read and watch file behavior (if you will) to decide whether it is malware or a legit file. While other programs like AV and AM in large amount await signature to detect (if they ever do), MCShield does not need that.
Q: Has MCShield been regularly updated last two years?
A: No, but MCShield doesn't really need not ever did rely on regular programs/signature updates.
Q: Is MCShield EOL?
A: Developers never declared EOL
Q: Is MCShield Windows 10 compatible?
A: Yes
Q: Is recommended to install MCShield if my USB is infected?
A: Yes. MCShield uses auto-routines to detect, prevent and stop USB malware to infect PC mashine.
MCShield Documentation in English, PDF document
http://www.mcshield.net/download/Doc/MCShield_Help_EN.pdf
-
Hello everyone.
Both main developers and MCS's owner, dr_Bora and bobby has been officially offline dedicated to there personal life.
Thus, MCShield hasn't been major upgraded in a while, and none of them didn't announced EOL (https://en.wikipedia.org/wiki/End-of-life_(product)).
As Pondus mentioned above and should be noted; MCShield never worked as other programs. In most cases, MCShield has been received database updated just to cover possible FP's. Then and now, MCShield still works on some other level. MCS owns heur. engines and routines (I wrote about MCS's power here on BC forum (https://www.bleepingcomputer.com/forums/t/523938/mcshield-malware-remover-not-mcafee-is-it-safe/?p=3299985)) to cover all known malware vector (https://en.wikipedia.org/wiki/Vector_(malware)) usb related attacks.
In other words, MCS read and watch file behavior (if you will) to decide whether it is malware or a legit file. While other programs like AV and AM in large amount await signature to detect (if they ever do), MCShield does not need that.
Q: Has MCShield been regularly updated last two years?
A: No, but MCShield doesn't really need not ever did rely on regular programs/signature updates.
Q: Is MCShield EOL?
A: Developers never declared EOL
Q: Is MCShield Windows 10 compatible?
A: Yes
Q: Is recommended to install MCShield if my USB is infected?
A: Yes. MCShield uses auto-routines to detect, prevent and stop USB malware to infect PC mashine.
Its still one of the first things i install and it already saved me from USB Malwares :)
-
@Magna: Thanks for your detailed answer..!! :)
-
@Magna: Thanks for your detailed answer..!! :)
+1
-
I use McShield too, but an abandonware security application cannot be trusted. As a second layer, ok. It uses very little resources. But, really, it just detects autorun.inf (or .ini, can't remember) files in last two years... It's becoming a placebo for me...
-
I use McShield too, but an abandonware security application cannot be trusted. As a second layer, ok. It uses very little resources. But, really, it just detects autorun.inf (or .ini, can't remember) files in last two years... It's becoming a placebo for me...
It is not a antivirus, it was made to detect those type of malware that use removable drives to spread, no more no less
-
It is not a antivirus, it was made to detect those type of malware that use removable drives to spread, no more no less
Therefore it's harmonizing with avast!
=Snake=
-
MCShield place in security world is as second layer. Porhaps even as third layer. The first as must is AV programs to prevent infections, second place is for AM programs to remove loaded malware on OS.
MCShield stands only for advanced USB security protection and malware removal. For everything else, it is necessary to use AV or AM.
I also agree with Lisandro's stand for abandonware app, still there is no reason to exclude MCShield duo its unique engine kind of work.
Plus, if you live in cloud you do not need MCShield.
I understand that for ordinary users is difficult to understand the fact that MCS does not need frequent updates (yes, they are desirable but not rly necessary) because they are taught that app needs to be regularly updated but if you think, technology or USB drive does not headway as OS technology. There is no reason for frequent updates. And all USB malware devs need to use already covered vectors to exploit so...
It may take years if not one decade when you may call MCShield as outdated software. MCS still hold the ground.
-
Thanks Magna. Your opinion counts far more than mine ever could.
-
Thanks Magna.
My comments were in the way of asking MCShield effectiveness if it is used side-by-side with Avast on the cloud.
We do support layered defense, just that, from time to time, we must rethink or move on from a particular layer due to technology changes.
-
Hi,
I'm using MCS since years on all of my machines. Some days ago, after I've put one of my USB sticks into a slot of one of my W8 machines, MCS scanned that stick and detected s.th. malicious and deleted it.
After i had a look at the log (see screenshot [excuse for German]), I didn't know nothing for I couldn't find a name of the data, which was deleted.
As I didn't get any answer in the German board, Asyn lead me to this thread and I hope, there comes an answer, which includes reason and name of the deleted data.
=Snake=
-
Iv been using MC Shield for a year now ..but my friends been on my case because they say its been abandoned though i love it soo much ..
they have been comparing it with Smadav ...mind if you guys can tell me which one is better
-
Iv been using MC Shield for a year now ..but my friends been on my case because they say its been abandoned though i love it soo much ..
they have been comparing it with Smadav ...mind if you guys can tell me which one is better
According to the Smadav website, it is a antivirus that use signature detection
MCShield is not a antivirus, it is a special tool that only target those malwaretypes that try to jump disk when you plug in a USB storage device.
It does this by behaviour and dont need signatures, there is a limited amount of tricks they can use to jump and all are known.
The few signatures MCShield containe are there to avoid false positives
Those malwaretypes that MCShield dont target will be targeted by your installed antivirus
-
Ouch they really dont now because they seem to be using it hand in hand with Avast since they thought it only scans usb ...
on its dashboard it states that is an usb scanner ,,..unless its been updated anyway il warn them tomorrow
-
I am still happy with VoodooShield on my comp.
Detected quite a few things/issues, that would have slipped by from my attention,
running silently in the background,
and that I now willingly had to run or block.
Works like a sort of second op when installing things..
Quite came to like that little devil of a blue shield tool sitting
there in the right hand corner of the desktop screen just over the time and date,
Anyone, using this too?
pol
-
I am still happy with VoodooShield on my comp.
Detected quite a few things/issues, that would have slipped by from my attention,
running silently in the background,
and that I now willingly had to run or block.
Works like a sort of second op when installing things..
Quite came to like that little devil of a blue shield tool sitting
there in the right hand corner of the desktop screen just over the time and date,
Anyone, using this too?
pol
Been using it a loooong time. Follow the forum. https://calendarofupdates.org/index.php?board=21.0 (https://calendarofupdates.org/index.php?board=21.0)
Dan (dev) is working on releasing version 5 beta, don't know when :)
-
Hi,
I'm using MCS since years on all of my machines. Some days ago, after I've put one of my USB sticks into a slot of one of my W8 machines, MCS scanned that stick and detected s.th. malicious and deleted it.
After i had a look at the log (see screenshot [excuse for German]), I didn't know nothing for I couldn't find a name of the data, which was deleted.
As I didn't get any answer in the German board, Asyn lead me to this thread and I hope, there comes an answer, which includes reason and name of the deleted data.
=Snake=
Excuse my not mentioning, that I was really sure, that the USB stick was empty. But now I feel insecure and want to know, what MCS was working on.
-
MCS scanned that stick and detected s.th. malicious and deleted it.
I dont see that name in the log/screenshot you posted ?
If quarantined you can restore and upload to virustotal and check
MCShield usually give MD5 on the file it detect, if you have that you can search it on VT to see if it has been scanned there before and referesh the scan result
If deleted then it is gone
-
MCS scanned that stick and detected s.th. malicious and deleted it.
1. I dont see that name in the log/screenshot you posted ?
2. If quarantined you can restore and upload to virustotal and check
3. MCShield usually give MD5 on the file it detect, if you have that you can search it on VT to see if it has
been scanned there before and referesh the scan result
4. If deleted then it is gone
1: I didn't see any either and that made me nervous.
2: Nothing quarantined.
3: MD5 is in my screenshot under F:\System Volume Information\WPSettings.dat
(MD5: 586717e89d779e4e7c678257dfcec986)
But it means nothing to me.
4: Detected and deleted right away. 1 malicious file!
-
@ =Snake=
3: the MD5 is a unique identifier for the file. Even if the name was changed but nothing else, the MD5 would be the same.
It may be possible to do a search on virustotal for that MD5 to see if it has been scanned before and what the results were. I know it is possible to do a search on VT for a files SHA-256 unique identifier, I have done that before, but don't know about MD5 unique identifier.
-
I have done that before, but don't know about MD5 unique identifier.
you can search MD5 / SHA-1 / SHA-256
3: MD5 is in my screenshot under F:\System Volume Information\WPSettings.dat
(MD5:586717e89d779e4e7c678257dfcec986)
https://www.virustotal.com/#/search/586717e89d779e4e7c678257dfcec986
Not scanned before so no result
-
@ =Snake=
3: the MD5 is a unique identifier for the file. Even if the name was changed but nothing else, the MD5 would be the same.
It may be possible to do a search on virustotal for that MD5 to see if it has been scanned before and what the results were. I know it is possible to do a search on VT for a files SHA-256 unique identifier, I have done that before, but don't know about MD5 unique identifier.
Thanks for your declarations. I never used VT before.
-
I have done that before, but don't know about MD5 unique identifier.
you can search MD5 / SHA-1 / SHA-256
3: MD5 is in my screenshot under F:\System Volume Information\WPSettings.dat
(MD5:586717e89d779e4e7c678257dfcec986)
https://www.virustotal.com/#/search/586717e89d779e4e7c678257dfcec986
Not scanned before so no result
Thanks, too, for your further declarations and the VT link. Am I right, that it doesn't matter, with which machine I start the VT scan?
-
@ =Snake=
3: the MD5 is a unique identifier for the file. Even if the name was changed but nothing else, the MD5 would be the same.
It may be possible to do a search on virustotal for that MD5 to see if it has been scanned before and what the results were. I know it is possible to do a search on VT for a files SHA-256 unique identifier, I have done that before, but don't know about MD5 unique identifier.
Thanks for your declarations. I never used VT before.
You're welcome, it can be a helpful tool for confirmation, etc.
It shouldn't matter which machine is used if you are just searching out information on the MD5, if it has been scanned before (or not). However if you are uploading a file, it would need to be on that system or transfer it to a USB stick which could be connected to any machine and uploaded.
-
You're welcome, it can be a helpful tool for confirmation, etc.
It shouldn't matter which machine is used if you are just searching out information on the MD5, if it has been scanned before (or not). However if you are uploading a file, it would need to be on that system or transfer it to a USB stick which could be connected to any machine and uploaded.
Well, yesterday evening, I tried that link Pondus wrote with my main machine (W7). After ~2 hours without any result, I killed it.
How long will it last normally?
-
You're welcome, it can be a helpful tool for confirmation, etc.
It shouldn't matter which machine is used if you are just searching out information on the MD5, if it has been scanned before (or not). However if you are uploading a file, it would need to be on that system or transfer it to a USB stick which could be connected to any machine and uploaded.
Well, yesterday evening, I tried that link Pondus wrote with my main machine (W7). After ~2 hours without any result, I killed it.
How long will it last normally?
The link i posted goes to the MD5 (you posted) search result at VT and as you should see it say No matches
Meaning that file has never been uploaded and scanned at VT so you will not get any result
If you had the file (not deleted by MCShield) you could have uploaded and scanned it for a result
EKSAMPLE: Here is scan result taken from a random file from my work computer
https://www.virustotal.com/#/file/eda1b1390404f14443e46a1c399f037f159ef6256ddd0ba17718729d12dc8d60/detection
at top you see SHA-256 / analysis date ... and below the scan result Clean
If you click the detail tab you also find MD5 and SHA-1
When it was first seen at VT and last scan / who made it if signed .....
EKSAMPLE: with malicious file
Here is a writeup written by TrendMicro about a malicious file(s), at the bottom they list the samples SHA-256 hash.
https://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-iot-malware-updated-with-mining-and-backdoor-commands-targets-wemo-devices/
I dont have this file so cant upload and scan it, but i copy the fist sample hash listed, goes to www.virustotal.com click the search tab, paste in the hash and search and voila i can see the detction result ... meaning this file has been uploaded and scanned at VT, clicking the details tab show that is was first uploaded First Submission 2019-03-23 18:39:19
https://www.virustotal.com/#/file/81cbb253ef6ad4803e3918883eed3ec6306ef12e7933c5723bd720d55d13a46a/detection
-
You're welcome, it can be a helpful tool for confirmation, etc.
It shouldn't matter which machine is used if you are just searching out information on the MD5, if it has been scanned before (or not). However if you are uploading a file, it would need to be on that system or transfer it to a USB stick which could be connected to any machine and uploaded.
Well, yesterday evening, I tried that link Pondus wrote with my main machine (W7). After ~2 hours without any result, I killed it.
How long will it last normally?
1. The link i posted goes to the MD5 (you posted) search result at VT and as you should see it say No matches
2. Meaning that file has never been uploaded and scanned at VT so you will not get any result
If you had the file (not deleted by MCShield) you could have uploaded and scanned it for a result
As I try to get all that stuff into my old head, I parted your answer into smaller ones. Let me correct
1: After about 2 hours running VT without any result (it said nothing at all, so I killed it!!!), should I have
waited longer?
2: My meaning was, that the stick was empty and I still don't know, what MCS has done! ???
-
1: After about 2 hours running VT without any result (it said nothing at all, so I killed it!!!), should I have waited longer?
NO, file has not been uploaded to VT so my link will not show a result
2: My meaning was, that the stick was empty and I still don't know, what MCS has done!
Correct, since we dont have the file we will never know what and why
If you want to find out how to use virustotal?
go to youtube and search "how to use virustotal" and you should find several videos
-
1: After about 2 hours running VT without any result (it said nothing at all, so I killed it!!!), should I have waited longer?
NO, file has not been uploaded to VT so my link will not show a result
2: My meaning was, that the stick was empty and I still don't know, what MCS has done!
Correct, since we dont have the file we will never know what and why
If you want to find out how to use virustotal?
go to youtube and search "how to use virustotal" and you should find several videos
Hey, now I know a bit more about VT and will get more later. Thanks a lot, Pondus.
-
Hello,
MCShield may still be competent software and thanks to his auto-routines and behavior MCShield should catch most of the new and old USB related malware.
But yes, unfortunately, MCShield isn't been updated for years. MCS's authors have simple move alone with there private lives. MCShield is now "as-is".
If any FP does occur (and it is likely possible nowadays), users should be able to de-Quarantine and whitelist any files they want from the settings.
-
Thanks for the info and the proggie. ;)
-
I've removed it from my systems and my recommended programs list.
-
I've removed it from my systems and my recommended programs list.
Heyy nob3160 why did you remove it?? care to share?
-
I've removed it from my systems and my recommended programs list.
Hey bob3160 why did you remove it?? care to share?
I would guess this would be clear, based on what has been said in the topic.
1. No longer updated
2. Possible FPs potentially based on the lack of updates.
Based on that the actual user would need to be competent to determine if what is detected is correct or an FP. My guess, when you are recommending programs you have to have confidence that it isn't going to have a possible adverse effect.
Whilst Bob is capable to make those decisions for himself, but he can't say that for others who might use it based on his recommendation.
-
I've removed it from my systems and my recommended programs list.
David hit the nail on the head.
I follow up my Avast sponsored Presentations (https://forum.avast.com/index.php?topic=78426.0) with tips, recommendations and quite a few free programs.
When a program becomes outdated and is no longer supported, it isn't something I can recommend to people
that in most instances know a whole lot less than I.
They do depend on my recommendations to be something they can depend on.
-
Although I do agree with the written above, I just want to point out that if the user has infected USB memory and AV or AM software can't help,
users can freely install MCShield to detect and remove USB related malware.
As I was sad before, MCShield has never been software to relay on his database per se. In early alpha testing, the idea was for MCShield be protable tool with no definition or settings, modern interface, etc. Just a run tool with his heur/engine power and log report. Then the real-time protection was added and this is MCShield we know today.
When I sad FP, in most cases it should be autorun.inf (https://en.wikipedia.org/wiki/Autorun.inf) related to no real FP or damaging the legit files or programs. Mark is on should.
But MCShield isn't updated for years and probably will not be in the future so ...yea. Unfortunately.
-
I'm running MCS everytime while using USB on all my os.
-
I'm running MCS everytime while using USB on all my os.
Your computer, your choice. :)
-
Your computer, your choice. :)
Better choice than a USB having been destroyed by MS. ;D
-
ok fine any new usb scanner you guy could recommend sine MC gets thumbs down from you
-
ok fine any new usb scanner you guy could recommend sine MC gets thumbs down from you
Not being able to recommend it to a novice user and a thumbs down are two different things.
If you know how to handle the possible false positives, it can still be an effective tool.
-
ok fine any new usb scanner you guy could recommend sine MC gets thumbs down from you
Not from me, i still use it "as is" on all machines
Since i posted this in april >> https://forum.avast.com/index.php?topic=226345.msg1500400#msg1500400
I noticed a huge increase in new install and detections the following weeks ( i wrote down the number from MCShield cloud)
Since then there have been:
31 612 new MCShield installs
447 710 new MCShield detections
So MCShield is still doing a good job out there
-
+1
Always installed on my OS's.
Plan on continuing as I still trust it and have not problem with any/if any FP's
-
+1
Always installed on my OS's.
Plan on continuing as I still trust it and have not problem with any/if any FP's
In all may years using it i have had one (when MCShield was new) with my Garmin GPS, and fixed by dr_Bora
-
After installing Windows Updates on 7/9/19, I'm getting an "EAccessViolation in module McShieldDS.exe" (Drive Scanner) error message from McShield, on both Win7 and Win10... screenshot from Win7 attached
-
I can confirm.
Tried a re-install however same error message: :-\
-
same here, almost same message
Windows 10, and it only happens at startup/restart
-
Same issue here too with the exact same error as KY331
-
Well, I guess that's the end of MCShield (as I doubt it'll get updated anymore). :(
-
After installing Windows Updates on 7/9/19, I'm getting an "EAccessViolation in module McShieldDS.exe" (Drive Scanner) error message from McShield, on both Win7 and Win10.
Well, I didn't update any OS, I'm still using MCS and have no probs with my systems.
-
Well, I guess that's the end of MCShield (as I doubt it'll get updated anymore). :(
Yes, that's unfortunate.
I won't run a progie that produces an error.
-
I haven't seen any errors ???
-
Hi, yes we have the same error report on my home forum. It would seem that Windows Update created the issue, not sure really.
Sadly, MCShield is kinda EOL.
-
Problem is fixed with new Windows update.
Windows 10 Version 1903:
https://support.microsoft.com/en-us/help/4508433/windows-10-update-kb4508433
https://support.microsoft.com/en-us/help/4505903
Windows 10 Version 1809:
https://support.microsoft.com/en-us/help/4512937/windows-10-update-kb4512937
https://support.microsoft.com/en-us/help/4464619
Windows 8.1:
https://support.microsoft.com/en-us/help/4504418/servicing-stack-update-kb4504418
https://support.microsoft.com/en-us/help/4507463
Windows 7:
https://support.microsoft.com/en-us/help/4490628
https://support.microsoft.com/en-us/help/4507437
-
Thanks for the info. :)
-
Thanks for the info. :)
+1 :)
-
That Pop Up nearly gave me a heart attack eish .thought Mc Shield`s era was ending ,.....
i love this Application i just wish the dev would come back ...
Guys take a look at the amount of Malware Treated Globally this is awesome ...
-
G'day Avast
I'm fully aware of this topic hasn't been discussed for a very long about MCShield, because, it's really important to know what's really going on, and the future is changing very quickly.
So, to all Windows 11 users, are you still using MCShield on your current W11 operating system, and it's really worth it to having MCShield program that hasn't been fully updated since 2014.
OR! We really don't need MCShield basically because it has been out of date, and I think the latest Avast Premium Security is protection all our USB connection before they do fully exploit our computers from dangerous malware and virus.
I would really love to get full feedback from Avast, IF we really need an outdated MCShield 2014 program onto Windows 11 OS.
Cheers
-
@ Speedy,
What does this have to do with Avast?
-
@ Speedy,
What does this have to do with Avast?
Avast automatically scans our usb connection, such as usb scandisk or any usb backup drive connection.
The point is, do we really need to installed MCShield outdated 2014 program as a second line of defence to protect all our usb connection on W11.
I've just moved from W8.1 to W11 since my ASUS 15-years old laptop died last week, and I've always had MCShield since the first version came out from Windows 2000 to W8.1 for as long as I can remember.
So, I've just moved from a 15-years old laptop, and back onto a brand-new desktop using W11 for the first time since this Thursday 13th of July.
-
So, you've got a new computer with new security enhancements and
want to muddy the water with old outdated unsupported software?
It's your computer, you decide. You already have my answer. :)
-
MCShield works on behaviour so does not need signature updates to catch usb malware.
MCShield signatures is for avoiding false positives.
It still run fine on my Win10 (dont have 11)
-
MCShield works on behaviour so does not need signature updates to catch usb malware.
MCShield signatures is for avoiding false positives.
It still run fine on my Win10 (dont have 11)
But, the real question is, Pondus, do I still need it on W11 (yes or no?) side by side with the latest Avast second line of defence protection against USB connection autorun exploit.
Is there a new version available? Does the latest Avast Premium protection against USB connection autorun exploit?
-
This is your best prevention scheme, even to not having to make use of it:
https://support.microsoft.com/en-us/windows/how-malware-can-infect-your-pc-872bf025-623d-735d-1033-ea4d456fb76b
polonus